20 Key Takeaways from the CMMC Final Rule for SMBs
Updated:
September 28, 2026
The CMMC program final rule, published on October 15, 2024, establishes requirements for verifying how defense contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Effective December 16, 2024, the rule defines assessment levels, evidence requirements, and obligations for maintaining CMMC status.
Small and medium-sized businesses (SMBs) must distinguish the rule’s requirements from the current rollout schedule. Phase 2 remains suspended as of September 2026, following the July 13 announcement, while Phase 1 self-assessment requirements continue.
This guide explains 20 key takeaways for SMBs, including assessment scope, subcontractor responsibilities, remediation limits, and ongoing compliance obligations.
Overview of CMMC Final Rule
The CMMC final rule establishes three cybersecurity levels with defined assessment, affirmation, and subcontractor requirements. Small and medium-sized businesses must distinguish these program requirements from the current implementation schedule. The following six takeaways explain the core obligations and rollout changes.
1. CMMC Security Levels
The CMMC framework sets requirements according to the information contractors handle and their contractual obligations.
| Level | Protection Focus | Security Requirements |
|---|---|---|
| Level 1: Foundational | It protects Federal Contract Information (FCI). | It requires the 15 basic safeguards in FAR clause 52.204-21, commonly mapped to 17 CMMC practices. |
| Level 2: Advanced | It protects Controlled Unclassified Information (CUI). | It requires 110 security requirements from NIST SP 800-171 Revision 2. |
| Level 3: Expert | It protects designated CUI against advanced persistent threats. | It adds 24 selected NIST SP 800-172 requirements to the Level 2 baseline. |
The program does not impose a universal 2025 compliance deadline. Organizations must confirm the level specified for their applicable contracts and assessment scope.
2. Assessment Types for Each Level
The CMMC rule establishes different assessment paths for each level.
These paths describe the regulatory model. As of September 2026, implementation remains paused in Phase 1, with Level 1 and Level 2 self-assessment requirements continuing. Contractors should check current contractual requirements before commissioning a certification assessment.
3. Phased Implementation and the Current Suspension
CMMC implementation began on November 10, 2025. The original rollout established four phases, but the July 13, 2026 Phase 2 suspension changes how contractors should interpret the planned milestones.
| Phase | Original Start Date | Planned Coverage and Current Context |
|---|---|---|
| Phase 1 | November 10, 2025 | It introduces Level 1 and Level 2 self-assessment requirements in applicable procurements. These requirements remain in effect. |
| Phase 2 | November 10, 2026 | It expands Level 2 certification requirements for applicable awards. The transition is suspended. |
| Phase 3 | November 10, 2027 | It expands Level 2 certification requirements to applicable option periods and introduces Level 3 requirements for designated awards. Contractors should monitor revised implementation guidance. |
| Phase 4 | November 10, 2028 | It extends CMMC requirements across applicable awards and option periods. This is the original scheduled milestone, subject to subsequent policy and regulatory changes. |
The suspension does not remove existing safeguarding obligations. Contractors must continue implementing applicable security requirements and maintaining required self-assessments and affirmations.
4. Assessment Validity and Annual Affirmation
Level 1 requires a new self-assessment every year. Final Level 2 and Level 3 statuses operate on three-year assessment cycles, subject to continuing compliance and required affirmations.
A senior affirming official must submit an affirmation through the Supplier Performance Risk System (SPRS) after each applicable assessment and annually thereafter. Conditional status has a separate 180-day closeout limit.
Organizations considering CMMC compliance with PreVeil must maintain their controls and evidence throughout the assessment cycle. Technology deployment alone does not establish or maintain CMMC status.
5. POA&M Eligibility and Closeout Deadlines
A Plan of Action and Milestones (POA&M) records corrective work for unmet requirements. Level 1 does not permit conditional status supported by a POA&M.
Conditional Level 2 status requires a score of at least 88 out of 110 and compliance with restrictions on eligible deficiencies. The score alone is insufficient. Certain requirements, including the System Security Plan, cannot remain unmet, and higher-value requirements generally cannot be deferred.
Eligible security gaps must be corrected and verified through a successful closeout assessment within 180 days of the conditional status date. Missing this deadline causes conditional status to expire and can affect eligibility for additional awards requiring that status.
6. Subcontractor Requirements and Flow-Down
Prime contractors must pass applicable CMMC requirements to subcontractors handling FCI or CUI. The required level depends on the information shared, the prime contract, and current implementation guidance.
Subcontractors handling only FCI generally require Level 1 when CMMC applies. Subcontractors handling CUI require at least Level 2 under the rule’s flow-down provisions. The required assessment type can depend on the prime contract; subcontractors do not automatically need the same level as the prime.
Prime contractors should complete three actions:
- Communicate Requirements: Specify the required CMMC level, assessment type, and information-handling obligations in applicable subcontracts.
- Verify Status: Confirm the subcontractor holds the required current status before subcontract award.
- Monitor Changes: Track status validity and changes to the information or services involved during performance.
Providing remediation assistance can support subcontractor readiness, but it is not a universal requirement for prime contractors to fund or perform that work.
Managing Third Parties and Service Providers
CMMC requires organizations to account for relevant subcontractors, cloud services, and external providers within their contractual obligations and assessment scope. Provider requirements depend on the information handled and security functions delivered. The following six takeaways cover assessments, provider responsibilities, scoping, scoring, and incident response.
7. Self-Assessment Versus Third-Party Assessment
The CMMC rule establishes assessment methods and renewal cycles according to the required level.
| CMMC Level | Assessment Requirements Under the Rule |
|---|---|
| Level 1 | Organizations complete an annual self-assessment against the 15 FAR safeguarding requirements and submit an annual affirmation. |
| Level 2 | Organizations complete a self-assessment or C3PAO certification assessment every three years, with annual affirmations. Both paths assess 110 NIST SP 800-171 Revision 2 requirements. |
| Level 3 | DIBCAC conducts a government assessment every three years, with annual affirmations. Final Level 2 C3PAO status is a prerequisite for the applicable scope. |
Level 2 self-assessments are not annual assessments or an option selected solely to reduce costs. Contract requirements and current implementation guidance determine the assessment path.
As of September 2026, Phase 2 remains suspended while Phase 1 self-assessment requirements continue. Businesses should use current contract requirements to plan compliance work and consider relevant cybercrime trends when evaluating security risks.
8. Cloud Providers and FedRAMP Requirements
Cloud services used to process, store, or transmit CUI must meet the applicable FedRAMP Moderate authorization or equivalency requirements. Verify the specific cloud offering and authorization boundary, rather than relying on the provider’s brand or a general compliance statement.
Document the provider’s responsibilities and your organization’s configuration, access management, and monitoring duties. A cloud service that handles security protection data without CUI has different assessment treatment and is assessed as a security protection asset within the customer’s scope.
9. Managed Service Providers and External Service Providers
A managed service provider does not automatically need independent CMMC certification simply because it supports a contractor. For Level 2, relevant services from a non-cloud external service provider that handles CUI are assessed within the contractor’s assessment scope.
Providers handling security protection data without CUI are assessed against requirements relevant to their security capabilities. An external provider may voluntarily obtain certification to reduce repeated assessment work, while separate subcontract obligations can impose additional requirements.
Document the arrangement in the System Security Plan (SSP), the provider’s service description, and a customer responsibility matrix. Agree on evidence access, assessment participation, incident escalation, and notification of service changes before the assessment begins.
10. Scoping Information Systems
CMMC scoping establishes which assets and services are assessed. Level 1 focuses on systems handling FCI. Level 2 includes CUI assets, security protection assets, contractor risk-managed assets, and specialized assets, with different assessment treatment for each category.
An appropriately designed CMMC enclave can limit where CUI is handled. Supporting security services and relevant connections still require consideration.
Organizations evaluating PreVeil integration should document data flows, system boundaries, and shared responsibilities. Accurate inventories and network diagrams support a consistent cybersecurity compliance program.
11. Scoring and Maintaining Compliance
CMMC findings use MET, NOT MET, and NOT APPLICABLE. MET requires evidence that all applicable assessment objectives are satisfied. A justified NOT APPLICABLE finding counts as MET for scoring.
Conditional Level 2 status requires at least 88 points and compliance with restrictions on eligible deficiencies. Qualifying POA&M items require successful closeout within 180 days.
Maintain compliance through control reviews, corrective work, current evidence, and required affirmations. A previous passing score does not establish that controls continue operating correctly.
12. Incident Response and Reporting Responsibilities
CMMC Level 2 requires an operational incident response capability, incident tracking and reporting, and testing of response capabilities. Define responsibilities for detection, analysis, containment, recovery, evidence preservation, and communication with service providers.
DFARS 252.204-7012 separately requires reporting qualifying cyber incidents to DoD within 72 hours of discovery. This covers incidents affecting covered contractor information systems, covered defense information, or the ability to provide designated operationally critical support.
The reporting requirement is not a blanket instruction to notify the contracting officer within 72 hours of every security lapse. Follow the reporting channel and obligations in the applicable contract. vCISO support can help establish reporting responsibilities and coordinate response planning.se plan in place helps mitigate damage during a breach and can be a determining factor in maintaining certification.
Implementing Controls Based on NIST 800-171
NIST SP 800-171 defines security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems. CMMC Level 2 uses Revision 2’s 110 requirements, while Level 1 uses the basic FAR safeguards for Federal Contract Information (FCI).
The following eight takeaways explain key implementation responsibilities.
13. Employee Training and Awareness
CMMC Level 2 requires security awareness, role-specific training, and instruction on recognizing potential insider threats. Training must prepare personnel to understand security risks and perform their assigned duties.
- Security Awareness: Explain risks associated with system use and the organization’s security policies and procedures.
- Role-Based Training: Prepare personnel to perform their specific security responsibilities.
- Insider Threat Awareness: Teach personnel to recognize and report potential indicators of insider threats.
Maintain records of training content and completion. Review training when responsibilities, systems, or relevant threats change.
14. Multifactor Authentication
CMMC Level 2 requires multifactor authentication (MFA) for specified account access within the assessment scope. MFA uses factors from different categories, such as a password and a security token.
| Account Type | Required MFA Coverage |
|---|---|
| Privileged Accounts | MFA is required for both local and network access. |
| Nonprivileged Accounts | MFA is required for network access. |
Verify coverage across relevant access paths, including administrator logins and remote connections. CMMC Level 1 does not independently impose an MFA requirement for every account handling FCI.
15. Vulnerability Scanning and Remediation
CMMC Level 2 requires periodic vulnerability scans of organizational systems and applications, plus scans when new vulnerabilities affecting them become known. Organizations must remediate vulnerabilities according to assessed risk.
Define scanning responsibilities, review findings, prioritize corrective work, and verify fixes. Scanning alone does not satisfy the requirement to address vulnerabilities, and penetration testing does not replace vulnerability scanning.
16. Configuration Management
CMMC Level 2 requires maintained system inventories, baseline configurations, and security settings. Organizations must control system changes, assess their security impact, and restrict unnecessary software, services, ports, and functions.
Record approved changes and check systems for deviations from established configurations. Organizations managing AI systems can coordinate this work with their ISO 42001 compliance activities, while evaluating CMMC requirements separately.
17. Encryption Requirements
CMMC Level 2 requires protection of CUI confidentiality during transmission and storage. Cryptography used to protect CUI confidentiality must be FIPS-validated, with appropriate cryptographic key management.
Transmission requirements permit alternative physical safeguards in qualifying circumstances. The general requirement to protect CUI at rest does not mandate encryption in every situation, but specific requirements apply to CUI on mobile devices and digital media during transport.
Verify the cryptographic module, its validation, and its operating configuration. A vendor’s “industry-standard encryption” claim alone does not demonstrate compliance.
18. Access Control Policies
CMMC access control requirements restrict system access to authorized users, processes, and devices. Level 2 requires least privilege, separation of duties, and controls over remote access, information flows, and permitted system activities.
Define access permissions according to job responsibilities and enforce them through system settings. Review permissions when personnel change roles or leave, and remove access that is no longer authorized.
19. Monitoring and Logging
CMMC Level 2 requires audit records that support monitoring, investigations, and accountability for user actions. Organizations must review and analyze logs, address logging failures, synchronize system clocks, and protect audit information from unauthorized changes or deletion.
Define the events to record, retention periods, and review responsibilities. Configure monitoring to detect attacks and unauthorized activity, and connect relevant findings to incident response procedures.
20. Physical Security Measures
CMMC Level 2 requires physical access restrictions for systems, equipment, and operating environments. Organizations must protect and monitor supporting facilities, manage visitors, and safeguard CUI at alternative work locations.
- Authorized Access: Restrict access to relevant systems and areas using suitable locks, staffed entry points, badges, or other controls.
- Visitor Management: Escort visitors and monitor their activity in protected areas.
- Physical Access Records: Maintain logs that record access to protected areas.
- Access Devices: Control the issuance, return, and revocation of keys, badges, and other access devices.
- Alternative Work Locations: Apply safeguards for CUI used at home offices or other approved locations.
Cameras and biometric readers are possible implementation choices. CMMC does not universally require either technology or blanket locking of every entrance and exit.Implementing these physical security measures, SMBs can protect sensitive information and comply with CMMC requirements.
Final Thoughts on CMMC Compliance for SMBs
The CMMC program rule took effect on December 16, 2024, and the associated contract requirements began phased implementation on November 10, 2025. As of September 2026, Phase 2 remains suspended, while Phase 1 self-assessment requirements continue.
SMBs should confirm their contractual obligations, define their assessment scope, address security gaps, and maintain evidence of working safeguards. These 20 takeaways provide a starting point for protecting government information and maintaining the CMMC status required for applicable defense contracts.
About Bright Defense
Bright Defense helps small and medium-sized defense contractors prepare for CMMC Level 1 and Level 2 assessments through gap reviews, remediation planning, documentation support, and ongoing compliance management.
Its compliance automation services use Drata to support evidence collection, control monitoring, and readiness tracking. Automated compliance workflows help teams organize records and manage recurring tasks, while consultants review implementation and address outstanding requirements.
Bright Defense supports PreVeil deployments for protecting Controlled Unclassified Information (CUI) through encrypted email and file sharing within a defined enclave. Effective implementation includes appropriate configurations, documented responsibilities, and safeguards across the assessment scope.
Contact Bright Defense to discuss your contract requirements and develop a practical CMMC readiness plan.
